Privacy policy for the customer register

1. Data controller

Kaarea Oy (2925981-7)
PL 180, 20101 Turku, Finland
Other contact details: www.kaarea.fi, tel. switchboard +358 20 764 9850

2. Contact person for matters concerning the register

Riikka Samuli
Postal address: PL 180, 20101 Turku, Finland
Visiting address: Lemminkäisenkatu 48, 20520 Turku, Finland
Email:riikka.samuli@kaarea.fi, tel. switchboard +358 20 764 9850

3. Name of the register

Kaarea’s customer register

4. Purposes and legal basis for processing personal data

Kaarea’s customer register for corporate and organisational customers contains information on the contact persons of Kaarea’s existing and potential client companies. In this context, the term “company” also includes organisations.

Personal data is processed for the following purposes: managing, developing, targeting and monitoring marketing, communications and sales; managing and administering customer relationships; analysing, categorising and reporting on customer relationships; and for other purposes related to the development of customer relationships, Kaarea’s services, and invoicing. In addition, personal data is processed in connection with the collection and processing of customer feedback.

The processing of personal data may be outsourced to external service providers to the extent appropriate.

The legal basis for the processing of personal data is the consent given by the data subject or the company they represent for one or more specific purposes. Processing may also be necessary to perform a contract with the data subject or the company they represent, or to take steps requested by them before entering into a contract.

5. Legitimate interests of the data controller or a third party
–

6. Data content of the register

The register contains the following information about the data subjects: last name, first names, postal address, telephone number, email address, title or position, IP address, user ID, name of the company represented by the data subject and the company’s contact and address details, and mailing lists. In addition, the register may contain information related to the provision, purchase, use and development of services, as well as marketing and sales, and other information relevant to the management or development of the customer relationship.

7. Regular sources of information

Primarily, the personal data entered and stored in the register is based on information provided by the data subject or the company they represent, or on information provided by Kaarea’s stakeholders and external service providers.

8. Recipients of personal data

Kaarea’s own personal data processors who require access to personal data to perform their tasks. Personal data may also be disclosed within the limits permitted and required by applicable law, for example to authorities that have the right to access the data.

9. Transfers to third countries and related safeguards

No data will be transferred outside the EU/EEA.

10. Data retention period and applicable retention criteria

Personal data is retained in the register until the customer relationship between the data subject and the customer can be considered to have ended. The end date is determined from the expiry of the customer agreement or the most recent service interaction or contact, to which a period of five years is added. Data serving as the basis for invoicing is retained for the duration required by applicable accounting legislation.

11. Principles of data protection

Access to the register’s data is restricted to certain individuals to the extent required by their duties.

The data processed in information systems is protected from external use by means of information network access rights and user-specific access rights. IT equipment is located in secure and monitored facilities.

Manually processed data is retained under supervision in files or filing systems and stored in locked cabinets with restricted and monitored access.

12. Rights of the data subject

The data subject has the right to access, correct, and request the erasure of their personal data in accordance with Kaarea’s data protection principles. The data subject may, at any time and on grounds relating to their particular situation, object to the processing of personal data concerning them. Requests for objection must be addressed in writing to the contact person for the register.

13. Automated decision-making and profiling

No automated decision-making or profiling is carried out based on the data subject’s personal data.